Spec resync 7/22/2026

.evergreen/scripts/kms_tester.py

@@ -93,6 +93,8 @@ def setup_kms(sub_test_name: str) -> None:
         return
 
     if sub_test_target == "azure":
+        # Opt in to corporate Azure credentials (DRIVERS-3392)
+        os.environ["FLE_AZURE_USE_CORPORATE"] = "YES"
         run_command("./setup-secrets.sh", cwd=kms_dir)
 
     if success:

.evergreen/scripts/setup_tests.py

@@ -382,6 +382,8 @@ def handle_test_env() -> None:
         if not DRIVERS_TOOLS:
             raise RuntimeError("Missing DRIVERS_TOOLS")
         csfle_dir = Path(f"{DRIVERS_TOOLS}/.evergreen/csfle")
+        # Opt in to corporate Azure credentials (DRIVERS-3392)
+        os.environ["FLE_AZURE_USE_CORPORATE"] = "YES"
         run_command(f"bash {csfle_dir.as_posix()}/setup-secrets.sh", cwd=csfle_dir)
         load_config_from_file(csfle_dir / "secrets-export.sh")
         run_command(f"bash {csfle_dir.as_posix()}/start-servers.sh")

.evergreen/spec-patch/PYTHON-5759.patch

@@ -1,6 +1,6 @@
 diff --git a/test/client-side-encryption/spec/unified/accessToken-azure.json b/test/client-side-encryption/spec/unified/accessToken-azure.json
 new file mode 100644
-index 00000000..510d8795
+index 000000000..9e7d68f44
 --- /dev/null
 +++ b/test/client-side-encryption/spec/unified/accessToken-azure.json
 @@ -0,0 +1,186 @@
@@ -107,7 +107,7 @@ index 00000000..510d8795
 +          ],
 +          "keyMaterial": {
 +            "$binary": {
-+              "base64": "n+HWZ0ZSVOYA3cvQgP7inN4JSXfOH85IngmeQxRpQHjCCcqT3IFqEWNlrsVHiz3AELimHhX4HKqOLWMUeSIT6emUDDoQX9BAv8DR1+E1w4nGs/NyEneac78EYFkK3JysrFDOgl2ypCCTKAypkn9CkAx1if4cfgQE93LW4kczcyHdGiH36CIxrCDGv1UzAvERN5Qa47DVwsM6a+hWsF2AAAJVnF0wYLLJU07TuRHdMrrphPWXZsFgyV+lRqJ7DDpReKNO8nMPLV/mHqHBHGPGQiRdb9NoJo8CvokGz4+KE8oLwzKf6V24dtwZmRkrsDV4iOhvROAzz+Euo1ypSkL3mw==",
++              "base64": "Vlza0NjSsxbiJbHUM++3EWyhd5/m4QHv0ZaH87LsljVDltHNZyR9YBFOTDFE1RKeY/uGSW35IdOLVxpHvo1/qBz7E6Iv14obBmniRetWZq0wxerm72LlF+VPTHHmNn1sIv3TY/HsHSx7S1U/ILaKukD7hBKZ5/4A2tPOXtdnTzC4Rpc8bRjaM8heQSNEWbTBPqcQ9xD4YLi+uQlzbLZjQA+Ljr540QJEwa7RGw8J22eo1sb3vSeDAhR24GH6RPJ5v72yElGcOZrKCjxnbd4mrCtSHssfOzCnK2Dw3mHikSLeBFGjnlXydBWiTn2AlhOs+YpXdAJ6Zm3xjkdJOXKytg==",
 +              "subType": "00"
 +            }
 +          },
@@ -126,8 +126,8 @@ index 00000000..510d8795
 +          },
 +          "masterKey": {
 +            "provider": "azure",
-+            "keyVaultEndpoint": "key-vault-csfle.vault.azure.net",
-+            "keyName": "key-name-csfle"
++            "keyVaultEndpoint": "drivers-3392-key-vault.vault.azure.net",
++            "keyName": "drivers-3392-keyname"
 +          }
 +        }
 +      ]
@@ -192,7 +192,7 @@ index 00000000..510d8795
 +}
 diff --git a/test/client-side-encryption/spec/unified/accessToken-gcp.json b/test/client-side-encryption/spec/unified/accessToken-gcp.json
 new file mode 100644
-index 00000000..f5cf8914
+index 000000000..f5cf8914f
 --- /dev/null
 +++ b/test/client-side-encryption/spec/unified/accessToken-gcp.json
 @@ -0,0 +1,188 @@
@@ -386,7 +386,7 @@ index 00000000..f5cf8914
 +}
 diff --git a/test/unified-test-format/invalid/clientEncryptionOpts-kmsProviders-azure-accessToken-type.json b/test/unified-test-format/invalid/clientEncryptionOpts-kmsProviders-azure-accessToken-type.json
 new file mode 100644
-index 00000000..8fe5c150
+index 000000000..8fe5c150a
 --- /dev/null
 +++ b/test/unified-test-format/invalid/clientEncryptionOpts-kmsProviders-azure-accessToken-type.json
 @@ -0,0 +1,31 @@
@@ -423,7 +423,7 @@ index 00000000..8fe5c150
 +}
 diff --git a/test/unified-test-format/invalid/clientEncryptionOpts-kmsProviders-gcp-accessToken-type.json b/test/unified-test-format/invalid/clientEncryptionOpts-kmsProviders-gcp-accessToken-type.json
 new file mode 100644
-index 00000000..2284e26c
+index 000000000..2284e26cb
 --- /dev/null
 +++ b/test/unified-test-format/invalid/clientEncryptionOpts-kmsProviders-gcp-accessToken-type.json
 @@ -0,0 +1,31 @@

test/asynchronous/test_encryption.py

@@ -671,8 +671,8 @@ class TestDataKeyDoubleEncryption(AsyncEncryptionIntegrationTest):
             "key": "arn:aws:kms:us-east-1:579766882180:key/89fcc2c4-08b0-4bd9-9f25-e30687b580d0",
         },
         "azure": {
-            "keyVaultEndpoint": "key-vault-csfle.vault.azure.net",
-            "keyName": "key-name-csfle",
+            "keyVaultEndpoint": "drivers-3392-key-vault.vault.azure.net",
+            "keyName": "drivers-3392-keyname",
         },
         "gcp": {
             "projectId": "devprod-drivers",
@@ -1263,8 +1263,8 @@ async def test_06_aws_endpoint_invalid_host(self):
     @unittest.skipUnless(any(AZURE_CREDS.values()), "Azure environment credentials are not set")
     async def test_07_azure(self):
         master_key = {
-            "keyVaultEndpoint": "key-vault-csfle.vault.azure.net",
-            "keyName": "key-name-csfle",
+            "keyVaultEndpoint": "drivers-3392-key-vault.vault.azure.net",
+            "keyName": "drivers-3392-keyname",
         }
         await self.run_test_expected_success("azure", master_key)
 
@@ -2585,8 +2585,8 @@ class TestRewrapWithSeparateClientEncryption(AsyncEncryptionIntegrationTest):
             "key": "arn:aws:kms:us-east-1:579766882180:key/89fcc2c4-08b0-4bd9-9f25-e30687b580d0",
         },
         "azure": {
-            "keyVaultEndpoint": "key-vault-csfle.vault.azure.net",
-            "keyName": "key-name-csfle",
+            "keyVaultEndpoint": "drivers-3392-key-vault.vault.azure.net",
+            "keyName": "drivers-3392-keyname",
         },
         "gcp": {
             "projectId": "devprod-drivers",

test/asynchronous/unified_format.py

@@ -477,7 +477,7 @@ class UnifiedSpecTestMixinV1(AsyncIntegrationTest):
     a class attribute ``TEST_SPEC``.
     """
 
-    SCHEMA_VERSION = Version.from_string("1.26")
+    SCHEMA_VERSION = Version.from_string("1.28")
     RUN_ON_LOAD_BALANCER = True
     TEST_SPEC: Any
     TEST_PATH = ""  # This gets filled in by generate_test_classes

test/client-side-encryption/corpus/corpus-key-azure.json

@@ -7,7 +7,7 @@
     },
     "keyMaterial": {
         "$binary": {
-            "base64": "n+HWZ0ZSVOYA3cvQgP7inN4JSXfOH85IngmeQxRpQHjCCcqT3IFqEWNlrsVHiz3AELimHhX4HKqOLWMUeSIT6emUDDoQX9BAv8DR1+E1w4nGs/NyEneac78EYFkK3JysrFDOgl2ypCCTKAypkn9CkAx1if4cfgQE93LW4kczcyHdGiH36CIxrCDGv1UzAvERN5Qa47DVwsM6a+hWsF2AAAJVnF0wYLLJU07TuRHdMrrphPWXZsFgyV+lRqJ7DDpReKNO8nMPLV/mHqHBHGPGQiRdb9NoJo8CvokGz4+KE8oLwzKf6V24dtwZmRkrsDV4iOhvROAzz+Euo1ypSkL3mw==",
+            "base64": "Vlza0NjSsxbiJbHUM++3EWyhd5/m4QHv0ZaH87LsljVDltHNZyR9YBFOTDFE1RKeY/uGSW35IdOLVxpHvo1/qBz7E6Iv14obBmniRetWZq0wxerm72LlF+VPTHHmNn1sIv3TY/HsHSx7S1U/ILaKukD7hBKZ5/4A2tPOXtdnTzC4Rpc8bRjaM8heQSNEWbTBPqcQ9xD4YLi+uQlzbLZjQA+Ljr540QJEwa7RGw8J22eo1sb3vSeDAhR24GH6RPJ5v72yElGcOZrKCjxnbd4mrCtSHssfOzCnK2Dw3mHikSLeBFGjnlXydBWiTn2AlhOs+YpXdAJ6Zm3xjkdJOXKytg==",
             "subType": "00"
         }
     },
@@ -26,8 +26,8 @@
     },
     "masterKey": {
         "provider": "azure",
-        "keyVaultEndpoint": "key-vault-csfle.vault.azure.net",
-        "keyName": "key-name-csfle"
+        "keyVaultEndpoint": "drivers-3392-key-vault.vault.azure.net",
+        "keyName": "drivers-3392-keyname"
     },
     "keyAltNames": ["azure"]
 }

test/client-side-encryption/custom/azure-dek.json

@@ -7,7 +7,7 @@
     },
     "keyMaterial": {
         "$binary": {
-            "base64": "n+HWZ0ZSVOYA3cvQgP7inN4JSXfOH85IngmeQxRpQHjCCcqT3IFqEWNlrsVHiz3AELimHhX4HKqOLWMUeSIT6emUDDoQX9BAv8DR1+E1w4nGs/NyEneac78EYFkK3JysrFDOgl2ypCCTKAypkn9CkAx1if4cfgQE93LW4kczcyHdGiH36CIxrCDGv1UzAvERN5Qa47DVwsM6a+hWsF2AAAJVnF0wYLLJU07TuRHdMrrphPWXZsFgyV+lRqJ7DDpReKNO8nMPLV/mHqHBHGPGQiRdb9NoJo8CvokGz4+KE8oLwzKf6V24dtwZmRkrsDV4iOhvROAzz+Euo1ypSkL3mw==",
+            "base64": "Vlza0NjSsxbiJbHUM++3EWyhd5/m4QHv0ZaH87LsljVDltHNZyR9YBFOTDFE1RKeY/uGSW35IdOLVxpHvo1/qBz7E6Iv14obBmniRetWZq0wxerm72LlF+VPTHHmNn1sIv3TY/HsHSx7S1U/ILaKukD7hBKZ5/4A2tPOXtdnTzC4Rpc8bRjaM8heQSNEWbTBPqcQ9xD4YLi+uQlzbLZjQA+Ljr540QJEwa7RGw8J22eo1sb3vSeDAhR24GH6RPJ5v72yElGcOZrKCjxnbd4mrCtSHssfOzCnK2Dw3mHikSLeBFGjnlXydBWiTn2AlhOs+YpXdAJ6Zm3xjkdJOXKytg==",
             "subType": "00"
         }
     },
@@ -26,8 +26,8 @@
     },
     "masterKey": {
         "provider": "azure",
-        "keyVaultEndpoint": "key-vault-csfle.vault.azure.net",
-        "keyName": "key-name-csfle"
+        "keyVaultEndpoint": "drivers-3392-key-vault.vault.azure.net",
+        "keyName": "drivers-3392-keyname"
     },
     "keyAltNames": ["altname", "azure_altname"]
 }